Merge lp:~joetalbott/uci-engine/user_auth into lp:uci-engine

[Joe Talbott]

ticket-system - Add first pass custom authorization class for APIs.

ticket-system - Add first pass custom authorization class for APIs.

[Paul Larson (pwlars)]

minor comment, otherwise looks like a good start to me

review: Approve

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:833
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1612/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1612/rebuild

review: Needs Fixing (continuous-integration)

[Celso Providelo (cprov)]

I have some questions inline that needs clarification, I am probably misunderstanding things.

review: Needs Information

[lp:~joetalbott/uci-engine/user_auth]

834. By Joe Talbott on 2014-10-21

ticket-system - Add authentication tests

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:834
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1613/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1613/rebuild

review: Approve (continuous-integration)

[lp:~joetalbott/uci-engine/user_auth]

835. By Joe Talbott on 2014-10-21

ticket-system - Switch away from global permissions.

836. By Joe Talbott on 2014-10-21

ticket-system - Turn off debugging.

837. By Joe Talbott on 2014-10-21

ticket-system - Fix typo that snuck into previous commit.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:837
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1618/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1618/rebuild

review: Needs Fixing (continuous-integration)

[lp:~joetalbott/uci-engine/user_auth]

838. By Joe Talbott on 2014-10-22

ticket-system - remove obsolete global permission code.

839. By Joe Talbott on 2014-10-22

ticket-system - Add docstring explaining custom authorization class.

840. By Joe Talbott on 2014-10-22

ticket-system - Add config option for internal hosts.

* adds tests

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:840
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1623/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1623/rebuild

review: Needs Fixing (continuous-integration)

[lp:~joetalbott/uci-engine/user_auth]

841. By Joe Talbott on 2014-10-23

ci-utils - Pep8 fixes for tastypie tests

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:841
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1624/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1624/rebuild

review: Approve (continuous-integration)

[Celso Providelo (cprov)]

Joe,

It looks pretty good, I just have few inline comments to be addresses/discussed about testing infrastructure.

review: Needs Fixing

[lp:~joetalbott/uci-engine/user_auth]

842. By Joe Talbott on 2014-11-06

ticket-system - Clean up tests and remove oauth bits.

843. By Joe Talbott on 2014-11-06

merge with trunk

* resolve conflicts

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:843
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1679/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1679/rebuild

review: Needs Fixing (continuous-integration)

[lp:~joetalbott/uci-engine/user_auth]

844. By Joe Talbott on 2014-11-06

Remove tests for unneeded functionality

We won't be bulk adding or updating reviews via the /review/ end-point so drop
the tests. This was a side-effect of finding out that we need to allow PUT for
these tests to pass but allowing PUT makes POST'ing a list not add entries if a
matching one already exists, thus causing another more important test to fail.

845. By Joe Talbott on 2014-11-06

Remove no longer needed self.review_permission

846. By Joe Talbott on 2014-11-06

Re-add overzealously removed import.

847. By Joe Talbott on 2014-11-06

Use .count() on querysets not len()

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:847
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1680/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1680/rebuild

review: Needs Fixing (continuous-integration)

[Celso Providelo (cprov)]

Thanks for the changes, Joe.

We are very close! Please address my inline comments and the test failure.

review: Needs Fixing

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:847
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1684/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1684/rebuild

review: Approve (continuous-integration)

[lp:~joetalbott/uci-engine/user_auth]

848. By Joe Talbott on 2014-11-06

Use TicketTastypieTestCase and ticket.uuid rather than .pk.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:848
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1686/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1686/rebuild

review: Needs Fixing (continuous-integration)

[lp:~joetalbott/uci-engine/user_auth]

849. By Joe Talbott on 2014-11-06

ticket-system - flake8 cleanup.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:849
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1689/
Executed test runs:

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/uci-engine-ci/1689/rebuild

review: Approve (continuous-integration)

Unmerged revisions

849. By Joe Talbott on 2014-11-06

ticket-system - flake8 cleanup.

848. By Joe Talbott on 2014-11-06

Use TicketTastypieTestCase and ticket.uuid rather than .pk.

847. By Joe Talbott on 2014-11-06

Use .count() on querysets not len()

846. By Joe Talbott on 2014-11-06

Re-add overzealously removed import.

845. By Joe Talbott on 2014-11-06

Remove no longer needed self.review_permission

844. By Joe Talbott on 2014-11-06

Remove tests for unneeded functionality

We won't be bulk adding or updating reviews via the /review/ end-point so drop
the tests. This was a side-effect of finding out that we need to allow PUT for
these tests to pass but allowing PUT makes POST'ing a list not add entries if a
matching one already exists, thus causing another more important test to fail.

843. By Joe Talbott on 2014-11-06

merge with trunk

* resolve conflicts

842. By Joe Talbott on 2014-11-06

ticket-system - Clean up tests and remove oauth bits.

841. By Joe Talbott on 2014-10-23

ci-utils - Pep8 fixes for tastypie tests

840. By Joe Talbott on 2014-10-22

ticket-system - Add config option for internal hosts.

* adds tests

=== modified file 'charms/precise/wsgi-app/config.yaml'
--- charms/precise/wsgi-app/config.yaml	2014-10-15 10:51:10 +0000
+++ charms/precise/wsgi-app/config.yaml	2014-11-06 19:15:32 +0000
@@ -63,6 +63,11 @@
     default: "INFO"
     description: The logging level.
 
+  internal_hosts:
+    type: string
+    default: ''
+    description: A comma separated list of internal hosts that don't need permissions checked.  Ticket-system only.
+
   # Apt info used by charmhelpers
   install_sources:
       type: string
 
=== modified file 'charms/precise/wsgi-app/hooks/hooks.py'
--- charms/precise/wsgi-app/hooks/hooks.py	2014-10-16 13:24:26 +0000
+++ charms/precise/wsgi-app/hooks/hooks.py	2014-11-06 19:15:32 +0000
@@ -244,6 +244,30 @@
     return reverseproxies
 
 
+def _get_internal_hosts():
+    filepath = os.path.join(_service_dir(), 'internal-hosts.json')
+    internal_hosts = []
+    if os.path.exists(filepath):
+        with open(filepath, 'r') as f:
+            internal_hosts = json.load(f)
+
+    return internal_hosts
+
+def _set_internal_hosts():
+    config = charmhelpers.core.hookenv.config()
+
+    internal_hosts = _get_internal_hosts()
+    internal_hosts += [x.strip() for x in
+                       config.get('internal_hosts').split(',') if x]
+    internal_hosts = list(set(internal_hosts))
+    if internal_hosts:
+        juju_log("Adding internal whitelisted hosts: {}".format(
+            internal_hosts))
+        with open(os.path.join(_service_dir(),
+                               'internal-hosts.json'), 'w') as f:
+            json.dump(internal_hosts, f)
+
+
 def _set_allowed_hosts():
     config = charmhelpers.core.hookenv.config()
     ips = [
@@ -306,6 +330,7 @@
                 _create_client(relation['url'])
 
     _set_allowed_hosts()
+    _set_internal_hosts()
     update_nrpe_config()
     _set_logging()
     _wsgi_reload()
@@ -322,6 +347,7 @@
     charmhelpers.core.hookenv.relation_set(
         relation_id, {'port': config["port"], 'hostname': host})
     _set_allowed_hosts()
+    _set_internal_hosts()
 
 
 @hooks.hook('json_status-relation-joined')
@@ -523,7 +549,16 @@
 @hooks.hook('oauth-server-relation-joined')
 @hooks.hook('oauth-server-relation-changed')
 def oauth_server_relation_joined_changed():
+    config = charmhelpers.core.hookenv.config()
+
     relation = charmhelpers.core.hookenv.relation_get()
+    internal_hosts = map(
+        unicode.strip, config.get('internal_hosts', '').split(','))
+    internal_hosts.append(relation.get('private-address'))
+
+    # use set() to make a unique list
+    config['internal_hosts'] = ','.join(set(internal_hosts))
+    config.save()
 
     client_redirect_uri = relation.get('url')
 
 
=== modified file 'charms/precise/wsgi-app/unit_tests/test_hooks.py'
--- charms/precise/wsgi-app/unit_tests/test_hooks.py	2014-10-16 13:24:26 +0000
+++ charms/precise/wsgi-app/unit_tests/test_hooks.py	2014-11-06 19:15:32 +0000
@@ -254,6 +254,16 @@
         self.assertTrue(
             os.path.exists(os.path.join(self.tmpdir, 'allowed_hosts.json')))
 
+    def test__get_internal_hosts(self):
+        self.assertEqual(0, len(hooks._get_internal_hosts()))
+
+    @mock.patch('hooks._get_internal_hosts')
+    def test__set_internal_hosts(self, _get_internal_hosts):
+        _get_internal_hosts.return_value = ['127.0.0.1']
+        hooks._set_internal_hosts()
+        self.assertTrue(
+            os.path.exists(os.path.join(self.tmpdir, 'internal-hosts.json')))
+
 
 class TestWebsiteHooks(RestishTestCase):
 
 
=== modified file 'ci-utils/ci_utils/tastypie/test.py'
--- ci-utils/ci_utils/tastypie/test.py	2014-05-27 11:41:04 +0000
+++ ci-utils/ci_utils/tastypie/test.py	2014-11-06 19:15:32 +0000
@@ -16,22 +16,40 @@
 import json
 import mock
 
+from django.contrib.contenttypes.models import ContentType
+from django.contrib.auth.models import User, Permission
 from tastypie.test import ResourceTestCase, TestApiClient
 
 
 class TastypieTestCase(ResourceTestCase):
     '''A base class for RESTFul services.'''
 
-    def setUp(self, resource_base):
+    @mock.patch('ticket.models.Ticket.create_container')
+    def setUp(self, resource_base, create_container):
         '''Set up an admin user that can make POST/PATCH calls.'''
+        super(TastypieTestCase, self).setUp()
         self.resource_base = resource_base
         if resource_base[-1] == '/':
             self.resource_base = resource_base[:-1]
         # create an api key for "post" operations
         # we currently don't use authentication|authorization, so its nothing
-        self.auth = None
         self.client = TestApiClient()
 
+        self.username = "testuser"
+        self.password = "testpass"
+        create_container.return_value = None
+        self.user = User.objects.create_user(username=self.username,
+                                             password=self.password)
+
+        content_type = ContentType.objects.get(
+            app_label='ticket', model='ticket',
+        )
+
+        for codename in ['review_ticket', 'change_ticket', 'add_ticket']:
+            permission = Permission.objects.get(
+                codename=codename, content_type=content_type)
+            self.user.user_permissions.add(permission)
+
     def _resource(self, resource):
         if resource[0] == '/' or resource.startswith('http://'):
             # assume the caller is passing the full path
@@ -46,16 +64,18 @@
     def post(self, resource, params):
         '''Create the resource and return location of the new object.'''
         resource = self._resource(resource)
-        resp = self.client.post(
-            resource, data=params, authentication=self.auth)
+        self.client.client.login(username=self.username,
+                                 password=self.password)
+        resp = self.client.post(resource, data=params)
         self.assertHttpCreated(resp)
         return resp['location']
 
     def patch(self, resource, params):
         '''Update an existing resource.'''
         resource = self._resource(resource)
-        resp = self.client.patch(
-            resource, data=params, authentication=self.auth)
+        self.client.client.login(username=self.username,
+                                 password=self.password)
+        resp = self.client.patch(resource, data=params)
         self.assertHttpAccepted(resp)
 
     def getResource(self, resource, params={}):
@@ -74,7 +94,9 @@
     def delete(self, resource):
         '''Delete an existing resource.'''
         resource = self._resource(resource)
-        resp = self.client.delete(resource, authentication=self.auth)
+        self.client.client.login(username=self.username,
+                                 password=self.password)
+        resp = self.client.delete(resource)
         return resp
 
 
 
=== modified file 'ticket_system/ticket/api.py'
--- ticket_system/ticket/api.py	2014-11-06 05:57:57 +0000
+++ ticket_system/ticket/api.py	2014-11-06 19:15:32 +0000
@@ -60,6 +60,8 @@
 )
 from project.api import SourcePackageResource
 
+from authorization import UserOrInternalAuthorization
+
 
 class PageNumberPaginator(Paginator):
     """Copes with YUI 'page'-number based pagination."""
@@ -223,7 +225,7 @@
     class Meta:
         queryset = SourcePackageUpload.objects.all()
         allowed_methods = ['get', 'post']
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
         resource_name = 'spu'
 
 
@@ -270,7 +272,7 @@
         # authorization mechanisms, not on the local resource queryset.
         queryset = Ticket.objects.filter(private=False)
         allowed_methods = ['get', 'post', 'patch']
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
         filtering = {
             "status": ALL,
         }
@@ -286,7 +288,7 @@
     """
 
     class Meta:
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
         list_allowed_methods = []
         detail_allowed_methods = []
         excludes = ['id']
@@ -328,7 +330,7 @@
     class Meta:
         queryset = SubTicket.objects.all()
         allowed_methods = ['get', 'post']
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
 
     def hydrate_sourcepackage(self, bundle):
         """Re-use existing `SourcePackage` when creating new SubTickets."""
@@ -360,7 +362,7 @@
     class Meta:
         queryset = TicketArtifact.objects.all()
         allowed_methods = ['get', 'post']
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
         filtering = {
             'type': ['exact'],
             'ticket': ['exact'],
@@ -375,7 +377,7 @@
     class Meta:
         queryset = SubTicketArtifact.objects.all()
         allowed_methods = ['get', 'post']
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
 
 
 class FullTicketArtifactResource(ModelResource):
@@ -447,7 +449,7 @@
         queryset = SubTicket.objects.all()
         fields = ['id', 'current_workflow_step', 'status']
         allowed_methods = ['get', 'patch']
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
         resource_name = 'updatesubticketstatus'
         filtering = {
             "id": ('exact'),
@@ -620,7 +622,7 @@
 
     class Meta:
         queryset = Review.objects.all()
-        authorization = Authorization()
+        authorization = UserOrInternalAuthorization()
         allowed_methods = ['get', 'post', 'patch', 'delete']
         filtering = {
             'ticket': ALL_WITH_RELATIONS,
 
=== added file 'ticket_system/ticket/authorization.py'
--- ticket_system/ticket/authorization.py	1970-01-01 00:00:00 +0000
+++ ticket_system/ticket/authorization.py	2014-11-06 19:15:32 +0000
@@ -0,0 +1,97 @@
+# Ubuntu Continuous Integration Engine
+# Copyright 2014 Canonical Ltd.
+
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU Affero General Public License version 3, as
+# published by the Free Software Foundation.
+
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from tastypie.authorization import Authorization
+from tastypie.exceptions import Unauthorized
+
+from ticket_system import settings
+from ticket.models import Review
+
+
+class UserOrInternalAuthorization(Authorization):
+    ''' Custom authorization class to control permissions for ticket
+    creation, editing, and reviewing.  Also allows a list of internal
+    IPs.
+
+    Expected permissions:
+        - ticket.add_ticket
+        - ticket.change_ticket
+        - ticket.review_ticket
+    '''
+
+    def _all_access(self, request, perm):
+        user = request.user
+        return user.has_perm(perm) or self._internal_address(request)
+
+    def _internal_address(self, request):
+        reload(settings)
+        return request.META.get('REMOTE_ADDR') in settings.internal_hosts
+
+    def read_list(self, object_list, bundle):
+        return object_list
+
+    def read_detail(self, object_list, bundle):
+        return True
+
+    def create_list(self, object_list, bundle):
+        if self._all_access(bundle.request, 'ticket.add_ticket'):
+            return object_list
+        else:
+            raise Unauthorized("You don't have write access")
+
+    def create_detail(self, object_list, bundle):
+        return self._all_access(bundle.request, 'ticket.add_ticket')
+
+    def update_list(self, object_list, bundle):
+        # TODO: for now we inspect the object type and enforce review
+        # permissions once we switch to the all-in-one ticket api we'll
+        # need to rework this logic. <[e-mail]>
+        if (object_list and object_list.count() > 0 and
+                isinstance(object_list[0], Review)):
+            if self._all_access(bundle.request, 'ticket.review_ticket'):
+                return object_list
+            else:
+                raise Unauthorized("You don't have write access")
+        else:
+            if self._all_access(bundle.request, 'ticket.change_ticket'):
+                return object_list
+            else:
+                raise Unauthorized("You don't have write access")
+
+    def update_detail(self, object_list, bundle):
+        # TODO: for now we inspect the object type and enforce review
+        # permissions once we switch to the all-in-one ticket api we'll
+        # need to rework this logic. <[e-mail]>
+        if (object_list and object_list.count() > 0 and
+                isinstance(object_list[0], Review)):
+            return self._all_access(bundle.request, 'ticket.review_ticket')
+
+        return self._all_access(bundle.request, 'ticket.change_ticket')
+
+    def delete_list(self, object_list, bundle):
+        if (object_list and object_list.count() > 0 and
+                isinstance(object_list[0], Review)):
+            if self._all_access(bundle.request, 'ticket.review_ticket'):
+                return object_list
+
+        raise Unauthorized("Sorry, no deletes.")
+
+    def delete_detail(self, object_list, bundle):
+        if (object_list and object_list.count() > 0 and
+                isinstance(object_list[0], Review)):
+            if self._all_access(bundle.request, 'ticket.review_ticket'):
+                return True
+
+        raise Unauthorized("Sorry, no deletes.")
 
=== modified file 'ticket_system/ticket/models.py'
--- ticket_system/ticket/models.py	2014-11-06 04:56:47 +0000
+++ ticket_system/ticket/models.py	2014-11-06 19:15:32 +0000
@@ -114,6 +114,9 @@
     class Meta:
         db_table = 'ticket'
         ordering = ['id']
+        permissions = (
+            ('review_ticket', 'Can review tickets'),
+        )
 
     SERIES_CHOICES = tuple(
         (series, series.upper()) for series in SUPPORTED_SERIES)
 
=== modified file 'ticket_system/ticket/tests/__init__.py'
--- ticket_system/ticket/tests/__init__.py	2014-10-14 15:10:23 +0000
+++ ticket_system/ticket/tests/__init__.py	2014-11-06 19:15:32 +0000
@@ -13,6 +13,7 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+from test_authorization import *
 from test_commands import *
 from test_full_read_api import *
 from test_models import *
 
=== added file 'ticket_system/ticket/tests/test_authorization.py'
--- ticket_system/ticket/tests/test_authorization.py	1970-01-01 00:00:00 +0000
+++ ticket_system/ticket/tests/test_authorization.py	2014-11-06 19:15:32 +0000
@@ -0,0 +1,138 @@
+# Ubuntu Continuous Integration Engine
+# Copyright 2014 Canonical Ltd.
+
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU Affero General Public License version 3, as
+# published by the Free Software Foundation.
+
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranties of
+# MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import json
+import os
+import tempfile
+
+from django.contrib.contenttypes.models import ContentType
+from django.contrib.auth.models import Permission
+from ci_utils.tastypie.test import TicketTastypieTestCase
+
+from ticket.models import Ticket
+from ticket_system import settings
+
+
+class TestUserOrInternalAuthorization(TicketTastypieTestCase):
+
+    def _setup_internal_ips(self):
+        self.tmpfile = tempfile.NamedTemporaryFile()
+        json.dump(['127.0.0.1'], self.tmpfile)
+        self.tmpfile.flush()
+
+    def get_credentials(self):
+        return ""
+
+    def _get_content_type(self):
+        return ContentType.objects.get(
+            app_label='ticket', model='ticket',
+        )
+
+    def _get_review_permission(self):
+        return Permission.objects.get(codename='review_ticket',
+                                      content_type=self._get_content_type())
+
+    def setUp(self):
+        super(TestUserOrInternalAuthorization, self).setUp('/api/v1/')
+
+        self.ticket = Ticket.objects.create(title="blah", description="blah")
+        self.assert_(self.ticket)
+
+        self.detail_url = "/api/v1/ticket/{0}/".format(self.ticket.uuid)
+        self.post_data = {
+            'id': '{}'.format(self.ticket.pk),
+        }
+
+    def test_ticket_detail_read_authenticated(self):
+        self.api_client.client.login(username=self.username,
+                                     password=self.password)
+        response = self.client.get(self.detail_url, format='json',
+                                   authentication=self.get_credentials())
+        self.assertEqual(200, response.status_code)
+
+    def test_ticket_detail_read_internal_ip(self):
+        self._setup_internal_ips()
+        os.environ['TS_INTERNAL_IPS_PATH'] = self.tmpfile.name
+        reload(settings)
+        response = self.client.get(self.detail_url, format='json')
+        if self.tmpfile:
+            self.tmpfile.close()
+        self.assertEqual(200, response.status_code)
+
+    def test_ticket_detail_read_unauthenticated(self):
+        """ Test that unauthenticated read requests are allowed. """
+        response = self.client.get(self.detail_url, format='json')
+        self.assertEqual(200, response.status_code)
+
+    def test_ticket_read_authenticated(self):
+        self.api_client.client.login(username=self.username,
+                                     password=self.password)
+        response = self.client.get("/api/v1/ticket/",
+                                   authentication=self.get_credentials())
+        self.assertEqual(200, response.status_code)
+
+    def test_ticket_read_unauthenticated(self):
+        response = self.client.get("/api/v1/ticket/")
+        self.assertEqual(200, response.status_code)
+
+    def skipped_test_ticket_write_unauthenticated(self):
+        self.assertHttpUnauthorized(self.api_client.post('/api/v1/ticket/',
+                                                         format='json',
+                                                         data=self.post_data))
+
+    def test_ticket_write_authenticated(self):
+        data = {}
+
+        self.api_client.client.login(
+            username=self.username, password=self.password)
+        response = self.api_client.post('/api/v1/ticket/', format='json',
+                                        data=data,
+                                        authentication=self.get_credentials())
+        self.assertEqual(201, response.status_code)
+
+        # Make sure a ticket was added
+        response = self.api_client.get("/api/v1/ticket/",
+                                       authentication=self.get_credentials())
+        self.assertEqual(200, response.status_code)
+
+        self.assertEqual(2, len(json.loads(response.content)['objects']))
+
+    def test_ticket_review_authenticated(self):
+        data = {'review_type': 'publishing', 'status': 'Doing stuff'}
+
+        self.ticket.review_set.create(workflow_step=0)
+
+        self.api_client.client.login(
+            username=self.username, password=self.password)
+        url = "/api/v1/review/{}/".format(self.ticket.review_set.all()[0].id)
+        response = self.api_client.patch(url, format='json',
+                                         data=data,
+                                         authentication=self.get_credentials())
+        self.assertEqual(202, response.status_code)
+
+    def test_ticket_review_no_perm_authenticated(self):
+        data = {'review_type': 'publishing', 'status': 'Doing stuff'}
+
+        self.user.user_permissions.remove(self._get_review_permission())
+
+        self.ticket.review_set.create(workflow_step=0)
+
+        self.api_client.client.login(
+            username=self.username, password=self.password)
+        url = "/api/v1/review/{}/".format(self.ticket.review_set.all()[0].id)
+        response = self.api_client.patch(url, format='json',
+                                         data=data,
+                                         authentication=self.get_credentials())
+        self.assertEqual(401, response.status_code)
 
=== modified file 'ticket_system/ticket/tests/test_write_api.py'
--- ticket_system/ticket/tests/test_write_api.py	2014-11-06 00:05:55 +0000
+++ ticket_system/ticket/tests/test_write_api.py	2014-11-06 19:15:32 +0000
@@ -329,8 +329,7 @@
     def test_patch_detail(self):
         # `Ticket` object can be patched via the API.
         new_data = {'owner': '[e-mail]'}
-        resp = self.client.patch('/api/v1/' + self.detail_url, data=new_data)
-        self.assertHttpAccepted(resp)
+        self.patch('/api/v1/' + self.detail_url, new_data)
         self.assertEqual(
             new_data['owner'], Ticket.objects.get(pk=self.ticket.pk).owner)
         self.assertEqual(Ticket.objects.count(), 1)
 
=== modified file 'ticket_system/ticket_system/settings.py'
--- ticket_system/ticket_system/settings.py	2014-10-07 10:04:01 +0000
+++ ticket_system/ticket_system/settings.py	2014-11-06 19:15:32 +0000
@@ -249,6 +249,13 @@
     with open(allowed) as f:
         ALLOWED_HOSTS = json.load(f)
 
+internal_hosts = []
+internal = os.environ.get('TS_INTERNAL_IPS_PATH')
+if internal and os.path.exists(internal):
+    with open(internal) as f:
+        json_str = f.read()
+        internal_hosts = json.loads(json_str)
+
 logging = os.path.join(BASEDIR, '../../../logging.json')
 if os.path.exists(logging):
     data = {}